Remote code execution via Redis cache deserialization

Unsafe deserialization in the Redis cache of PublicCMS 4.0.202302.e allows remote attackers to execute arbitrary code via crafted cache data. A Redis-backed cache read deserializes an attacker-written Java object that invokes a BadAttributeValueExpException-to-POJONode-to-TemplatesImpl gadget chain; a replacement writeReplace method preserves the malicious object graph. Redis caching must be enabled, the attacker must control the Redis database, and a website request must trigger the cache read, after which code executes in the PublicCMS service context.